monterail/guidelines — pull request #171 by jandudulski (2013-10-24 23:41:17+00:00)
Title: Never ever switch from :delete to :get for logout action in devise

I know that using POST/DELETE for sign out action is kind of PITA but you don't want your users to be automagically signed out, do you?

Every action which changes the state of application should use CSRF token, including sign out. Homakov describes the problem on [his blogpost](http://homakov.blogspot.com/2012/04/csrf-afterparty-must-read-rules.html).

/cc @teamon @sheerun @Ostrzy @chytreg @jcieslar @szajbus